Iran International English on X: "An Iranian state

X • October 23, 2026

An Iranian state- hacking group used command-and-control infrastructure hosted in the United States this year after a months-long pause in operations, according to cybersecurity firm Semperis.

The group, known as Prince of Persia and also tracked as Infy, has operated for nearly two decades and has primarily targeted Iranian dissidents, along with government and private-sector organizations in the US, Europe and the Middle East.

Semperis researcher Tomer Bar said he identified a command-and-control server in the US in August, the first time the group had been found using US-based infrastructure since 2016.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Nation-State Group Hosts C2 Infrastructure in the US Semperis has identified the Iranian nation-state threat group known as Prince of Persia operating a command-and-control (C2) server in the United States for the first time in a decade. This discovery was made by Tomer Bar, AVP of Security Research at Semperis, who has tracked the group for ten years. The group had previously relied on European hosting but shifted its operations back to the U.S. after going dark in February 2026, coinciding with the onset of conflict between Iran, the U.S., and Israel. Recent victims of this group include Iranian dissidents, and the group employs advanced techniques such as using Telegram API channels and domain-generation algorithms to maintain its infrastructure. The malware used in these campaigns includes Foudre, Tonnerre, and Tornado, which provide extensive surveillance capabilities. Semperis recommends organizations update their security controls and monitor for unusual Telegram traffic to mitigate risks associated with this threat. 11 sources 63

Extracted Entities

Iran International English on X: "An Iranian state

The full story

Extracted Entities

APT Groups (2)

Countries (2)

MITRE ATT&CK (1)